How and Why to Block Ads

Ads today are as annoying as they are ubiquitous. They slow down load times and make some websites almost unusable. However, ads can also track what you do and even serve you malware or phishing websites. Today I’ll explain why and how to block them.

Security & Privacy Risks of Ads

Because we’ve grown accustomed to ‘free’ online content, we’ve pretty much solidified the ad-supported web financial model. Unfortunately, the ad networks have resorted to horrendous amounts of tracking and profiling to maximize their profits at the expense of our privacy. It’s one thing to watch ads – it’s an entirely different thing for ads to watch you. Advertising is not the problem here – it’s the rampant collection of very personal data that’s the issue.

Maybe you’ve made peace with this bargain. You’re boring and have nothing to hide. And if you have to look at ads, why not look at ads for stuff you actually might wish to buy? But this data is being collected, collated, correlated, packaged and sold to several third parties, including law enforcement and intelligence agencies (both foreign and domestic). If you’re not convinced on how that upsets the democratic power balance, I encourage you to read Means of Control and/or listen to my interview with the author, Byron Tau. (Privacy is Power and Data and Goliath are other great reads in this space.)

But it’s even worse than that. Web page ads are served up by massive, automated advertising networks – and bad guys buy ad space to serve up fake (phishing) websites and even malware. This is called malvertising and it’s rampant these days. Advertisers are aware that people are turning to ad blockers for both privacy and security reasons, but it’s not clear that they are willing or even able to address the underlying problems. So until then, I suggest you block most ads. Today I’ll give you two great options. (I use both.)

Block Ads in Your Browser

Because ads are so ubiquitous and annoying, ad blockers are some of the most popular web browser plugins. It’s been called the biggest boycott in history. But not all ad blockers are equally effective. For example, while AdBlock Plus is very popular, it has this odd notion of acceptable ads that are not blocked.

My go-to ad blocker is uBlock Origin (do not confuse it with “uBlock” … it’s an ugly story). Out of the box, it blocks most ads well and it’s highly customizable with additional filters. It also has a wonderful ‘zapper‘ feature that allows you to kill annoying pop-ups, pop-overs, and more. Unfortunately, Google’s recent forced adoption of a proprietary plugin spec called Manifest v3, the Chrome browser (and others based on the same Chromium engine like Microsoft Edge) will severely limit uBlock Origin’s ability to block ads like it used to, which forced the developer to release a less effective uBlock Origin Lite for those browsers. (This is one reason I like using Firefox over Chrome.)

If for some reason uBlock Origin isn’t to your liking, check out EFF’s Privacy Badger or DuckDuckGo’s Privacy Essentials. Each of these plugins works differently and you could theoretically use them all, but uBlock Origin or Privacy Badger alone is probably sufficient.

Block Ads Everywhere Using DNS

There’s another way to block ads that works at a lower, more fundamental level: by using DNS filtering. The Domain Name System (DNS) is basically a phone book for internet numbers, converting names (eg, firewallsdontstopdragons.com) to a computer-routable IP address (eg, 34.174.87.100). If you intercept the name-to-number lookup of known ad servers, you can prevent ads from loading. If you use an ad-blocking DNS service on your device, you can prevent ads loading in most apps, not just your browser. If you direct your home router to use an ad-blocking DNS, you can block internet-based ads on every device in your home.

If you don’t change any default configurations, your smart devices and computers will use your internet service provider for DNS lookups. And the ISP is almost certainly recording, analyzing and perhaps even selling this browsing data. You can override this by changing the default DNS server on your iPhone, Android phone, Mac or PC. At home, you can also set a custom DNS server in your home WiFi router which will affect all the devices in your house (except those with an individually configured custom DNS server, like we just described doing). See this article for detailed help with all of these cases.

Two Great DNS Options

There are many free public DNS services you can choose, many of which have decent privacy and security features. However, I prefer using a paid service called NextDNS. (They have a free option, but it’s pretty limited.) You can configure what NextDNS blocks on your dashboard, see logs and analytics. It can be very revealing. Below you can see a sample of just some of the analytics from my dashboard (I was out of town there for a bit). Techlore has a fantastic, comprehensive guide on using NextDNS here – it has a TON of very useful features.

If you are a do-it-yourselfer or don’t want to trust a third party, check out the Pi-Hole project. You set up your own in-home DNS server based on the Raspberry Pi (RPi for short) mini-computer. The RPi is only $35, but you’ll need a power supply, SD card and case, which will easily double that cost. (Try the slightly older RPi v4 to save some money.) I used to run one of these and loved it, but switched to NextDNS so I could protect my devices everywhere (not just at home).

Caveats & Gotchas

There are a few things to know before you do this. First and foremost, ads make the internet world go ’round. Some websites can detect when you’re blocking their ads and will deny you access or pop-up an admonishing warning. You can disable ad blocking for individual sites you want to access and/or support, either for one time or every time. Turning off NextDNS for a particular site is also possible, but requires logging in to your NextDNS dashboard and adding it to your “allow” list.

Some websites will break when you try to block certain elements – either it will fail to load or some features won’t work. Your only real option at that point is to disable your ad blocker for that page or move on. If you use both a custom DNS and a browser plugin, then that complicates your debugging when sites don’t work right. But to me it’s well worth doing. Again, this isn’t just about removing annoyances, it’s improving your privacy and security.

As an example, just about every link I click on from a newsletter is blocked – because most newsletter mailing services replace the original links with redirect links that gather analytics. Tracker blockers will often block analytics links. I usually just copy and paste the text of the URL (if given) to get around this – or log in to my VPN briefly (which uses its own DNS), click the link, and then log out of my VPN.

Both of the above ad blocking options (browser-based and DNS-based) have pros and cons, and there are actually reasons to use both – and I use both personally. The only downside is that it can make troubleshooting broken websites trickier.

Note that using a custom DNS server (even one with DNS over HTTPS) doesn’t prevent your ISP from knowing the websites you visit. They can still do a reverse IP lookup to determine what sites you’re visiting. To really mask your traffic, you’d need to use a VPN.